Performing a security action with regard to an access token based on clustering of access requests
Techniques are described herein that are capable of performing a security action with regard to an access token based on clustering of access requests. Subsets of access requests are clustered into respective clusters, which correspond to respective requestor types, based at least on the access requests in the subsets having respective attributes that indicate the respective requestor types. The access requests request access to cloud resources. Access behavior(s) associated with the access requests that are included in respective cluster(s) are identified. A security action is performed with regard to an access token based at least on at least one of the access behavior(s).
1 . A system comprising:
memory; and
a processing system coupled to the memory, the processing system configured to:
cluster subsets of access requests into respective clusters, which correspond to respective requestor types, based at least on the access requests in the subsets having respective attributes that indicate the respective requestor types, the access requests requesting access to cloud resources;
identify access behaviors that are associated with the access requests in the respective clusters and that correspond to a common access token;
determine that a difference between a scope of permissions that are defined by the common access token and a scope of a first access behavior, which is associated with a first cluster that corresponds to a first requestor type and which corresponds to the common access token, is greater than or equal to a threshold difference; and
based at least on the difference between the scope of the permissions that are defined by the common access token and the scope of the first access behavior being greater than or equal to the threshold difference, perform a security action with regard to the common access token.
2 . The system of claim 1 , wherein the processing system is configured to:
cluster the subsets of the access requests into the respective clusters based at least on:
the access requests in the subsets being initiated by sources having internet protocol (IP) addresses in respective ranges of IP addresses that indicate the respective requestor types;
the subsets of the access requests having respective referrer attributes that indicate respective intermediate entities that correspond to the respective requestor types; or
the access requests in the subsets being received from user-agents that indicate the respective requestor types.
3 . The system of claim 1 , wherein the processing system is configured to:
identify the access behaviors that are associated with the access requests in the respective clusters and that correspond to the common access token by analyzing at least one of the following:
a data plane log that describes accesses of end users to a cloud resource that use the common access token;
a token management service log that describes administrative operations that are performed using the common access token.
4 . The system of claim 1 , wherein the processing system is configured to:
perform the security action by generating a security alert, which indicates the difference between the scope of the permissions that are defined by the common access token and the scope of the first access behavior.
5 . The system of claim 1 , wherein the processing system is configured to:
determine that an amount by which the scope of the permissions that are defined by the common access token exceeds the scope of the first access behavior, which is associated with the first cluster and which corresponds to the common access token, is greater than or equal to the threshold difference; and
based at least on the amount by which the scope of the permissions that are defined by the common access token exceeds the scope of the first access behavior being greater than or equal to the threshold difference, perform the security operation by providing a recommendation to reduce the scope of the permissions that are defined by the common access token.
6 . The system of claim 1 , wherein the processing system is configured to:
determine that an amount by which the scope of the first access behavior, which is associated with the first cluster and which corresponds to the common access token, exceeds the scope of the permissions that are defined by the common access token is greater than or equal to the threshold difference; and
based at least on the amount by which the scope of the first access behavior exceeds the scope of the permissions that are defined by the common access token being greater than or equal to the threshold difference, perform the security action by providing a recommendation to increase the scope of the permissions that are defined by the common access token.
7 . The system of claim 1 , wherein the processing system is configured to:
determine that an amount by which the scope of the first access behavior, which is associated with the first cluster and which corresponds to the common access token, exceeds the scope of the permissions that are defined by the common access token is greater than or equal to the threshold difference; and
based at least on the amount by which the scope of the first access behavior exceeds the scope of the permissions that are defined by the common access token being greater than or equal to the threshold difference, perform the security action by providing a recommendation to replace the common access token with multiple access tokens that define respective sets of permissions that have respective different scopes.
8 . The system of claim 1 , wherein the processing system is configured to:
featurize the attributes of the access requests in the subsets to provide features, which are numerical representations of the attributes; and
cluster the subsets of the access requests into the respective clusters based at least on the features.
9 . The system of claim 1 , wherein the first access behavior indicates predicted likelihoods of respective actions to be performed with regard to an arbitrary access request that corresponds to the first requestor type and that uses the common access token; and
wherein the difference between the scope of the permissions that are defined by the common access token and the scope of the first access behavior takes into consideration the predicted likelihoods of the respective actions to be performed with regard to the arbitrary access request.
10 . A method implemented by a computing system, the method comprising:
clustering subsets of access requests into respective clusters, which correspond to respective requestor types, based at least on the access requests in the subsets having respective attributes that indicate the respective requestor types, the access requests requesting access to cloud resources;
receiving a user-initiated request to create a new access token, the user-initiated request requesting that the new access token define selected permissions;
determining that a difference between a scope of the selected permissions and a scope of an identified access behavior associated with the access requests that are included in an identified cluster exceeds a threshold difference; and
based at least on the user-initiated request and the difference between the scope of the selected permissions and the scope of the identified access behavior exceeding the threshold difference, providing a recommendation that the new access token define designated permissions as a result of the designated permissions having a scope that is based at least on the scope of the identified access behavior.
11 . The method of claim 10 , wherein determining that the difference between the scope of the selected permissions and the scope of the identified access behavior associated with the access requests that are included in the identified cluster exceeds the threshold difference comprises:
determining that an amount by which the scope of the selected permissions exceeds the scope of the identified access behavior, which is associated with the access requests that are included in the identified cluster, is greater than or equal to the threshold difference; and
wherein providing the recommendation comprises:
based at least on the user-initiated request and further based at least on the amount by which the scope of the selected permissions exceeds the scope of the identified access behavior being greater than or equal to the threshold difference, providing the recommendation that the new access token define the designated permissions having the scope that is less than the scope of the selected permissions.
12 . The method of claim 10 , wherein determining that the difference between the scope of the selected permissions and the scope of the identified access behavior associated with the access requests that are included in the identified cluster exceeds the threshold difference comprises:
determining that an amount by which the scope of the identified access behavior, which is associated with the access requests that are included in the identified cluster, exceeds the scope of the selected permissions is greater than or equal to the threshold difference; and
wherein providing the recommendation comprises:
based at least on the user-initiated request and further based at least on the amount by which the scope of the identified access behavior exceeds the scope of the selected permissions being greater than or equal to the threshold difference, providing the recommendation that the new access token define the designated permissions having the scope that is greater than the scope of the selected permissions.
13 . The method of claim 10 , wherein determining that the difference between the scope of the selected permissions and the scope of the identified access behavior associated with the access requests that are included in the identified cluster exceeds the threshold difference comprises:
determining that an amount by which the scope of the identified access behavior, which is associated with the access requests that are included in the identified cluster, exceeds the scope of the selected permissions is greater than or equal to the threshold difference; and
wherein providing the recommendation comprises:
based at least on the user-initiated request and further based at least on the amount by which the scope of the identified access behavior exceeds the scope of the selected permissions being greater than or equal to the threshold difference, providing a recommendation to create at least two new access tokens, including the new access token and a second new access token, such that the new access token defines the designated permissions having the scope that is greater than the scope of the selected permissions and such that the second new access token defines the selected permissions.
14 . The method of claim 10 , wherein the identified access behavior indicates predicted likelihoods of respective actions to be performed with regard to an arbitrary access request that corresponds to a first requestor type, which corresponds to the identified cluster; and
wherein the difference between the scope of the selected permissions and the scope of the identified access behavior takes into consideration the predicted likelihoods of the respective actions to be performed with regard to the arbitrary access request.
15 . The method of claim 10 , further comprising:
receiving a user-initiated authorization message that authorizes configuring the new access token to define the designated permissions; and
based at least on the user-initiated authorization message, creating the new access token by configuring the new access token to define the designated permissions.
16 . The method of claim 10 , wherein clustering the subsets of the access requests into the respective clusters comprises:
clustering the subsets of the access requests into the respective clusters based at least on:
the access requests in the subsets being initiated by sources having IP addresses in respective ranges of internet protocol (IP) addresses that indicate the respective requestor types;
the subsets of the access requests having respective referrer attributes that indicate respective intermediate entities that correspond to the respective requestor types; or
the access requests in the subsets being received from user-agents that indicate the respective requestor types.
17 . The method of claim 10 , further comprising:
determining the identified access behavior by analyzing at least one of the following:
a data plane log that describes accesses of end users to a cloud resource;
a token management service log that describes administrative operations that are performed using an access token utilized by at least a subset of the access requests.
18 . The method of claim 10 , further comprising:
featurizing the attributes of the access requests in the subsets to provide features, which are numerical representations of the attributes;
wherein clustering the subsets of the access requests comprises:
clustering the subsets of the access requests into the respective clusters based at least on the features.
19 . A computer program product comprising a computer-readable storage medium having instructions recorded thereon for enabling a processor-based system to perform operations, the operations comprising:
clustering subsets of access requests into respective clusters, which correspond to respective requestor types, based at least on the access requests in the subsets having respective attributes that indicate the respective requestor types, the access requests requesting access to cloud resources;
receiving a user-initiated request to create a new access token;
based at least on the user-initiated request, providing a recommendation that the new access token define designated permissions as a result of the designated permissions having a scope that is based at least on a scope of an identified access behavior associated with the access requests that are included in an identified cluster of the access requests;
receiving a user-initiated authorization message that authorizes configuring the new access token to define the designated permissions; and
based at least on the user-initiated authorization message, creating the new access token by configuring the new access token to define the designated permissions.
20 . The method of claim 10 , further comprising:
determining the identified access behavior based at least on frequencies with which access actions are requested by the access requests in the identified cluster over a specified period of time.